54c8cac96991ff0ffb9ab0ccff3484e3053d7e68b4b5781679d29caf9611a603

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 07:36

Target

d58f468e7d3f74e044cd06575ac70745.dll
Size

54KB
MD5

d58f468e7d3f74e044cd06575ac70745
SHA1

7594c4bfd8c8671654d35b0bb01bcef7a7e21bc5
SHA256

54c8cac96991ff0ffb9ab0ccff3484e3053d7e68b4b5781679d29caf9611a603
SHA512

35e866171589d25aec119dfff3c5eac9194370e1f6be62aad2c4bde91743ede2ef07ff4d025fbf80d59d11242571767f379480c7a55a182fe898f1f6c80c0375
SSDEEP

768:UIs8px/C9oQ3mbTCjMA2ycwrst4vHiaSZMQCqtDvF5gYs8L/IZFmiP7D4BlL4/kC:UInUmvCj/2lqHJOMQbU8wyiP7D6LLC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3868	4844	rundll32.exe	89
PID 4844 wrote to memory of 3868	4844	rundll32.exe	89
PID 4844 wrote to memory of 3868	4844	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d58f468e7d3f74e044cd06575ac70745.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d58f468e7d3f74e044cd06575ac70745.dll,#1
  2⤵
  PID:3868